Privacy Policy

2. Overview

We process only the data we need for the purposes below. We do not sell personal data, do not use it for advertising, and do not create profiles for automated decisions.

3. Website Hosting and Server Logs

This website is hosted by Squarespace (Squarespace Ireland Limited, Dublin, Ireland, and Squarespace, Inc., New York, USA) as our processor. When you visit the site, technical request data is recorded automatically: IP address, date and time, the page requested, the referring URL, and browser and operating system.

This data is used to deliver the site, detect attacks and fix faults. We do not combine it with other data. Squarespace keeps it only as long as necessary for these purposes.

4. Cookies and Visitor Statistics

Squarespace sets cookies that are strictly necessary for the site to work, for example for security and to remember your cookie choice. These are set without consent.

Cookies for Squarespace’s built-in visitor statistics are set only if you agree in the cookie banner. You can withdraw your consent at any time via the cookie settings link in the footer; this does not affect processing carried out before withdrawal. We do not use advertising pixels, retargeting or third-party tracking.

5. Email and Enquiries

When you write to us, we process the content of your message and your contact details to answer you and, where relevant, to prepare a mandate. Our email is hosted by Hostpoint AG, Switzerland, as our processor.

For business contacts and ongoing discussions we keep records in the CRM HubSpot (data stored in the EU). We enter this information manually; it is limited to business contact details and notes on the matter discussed.

If no mandate follows, we delete enquiry and CRM data no later than 24 months after our last contact, unless you ask us to delete it earlier.

6. Booking a Call (Cal.com)

Our booking links take you to a scheduling page hosted by Cal.com, Inc., USA, which acts as our processor. What you enter there (name, email, meeting details) is used only to arrange and hold the call. Cal.com processes your IP address and technical data when you open the page. Booking data is deleted on the same terms as enquiries (section 5).

7. AI Maturity Check

The AI Maturity Check calculates your result in your browser. When you finish, six dimension scores and one overall score are stored, together with a random record identifier and a timestamp. Your individual answers, names, company names and email addresses are not stored. The stored scores cannot be linked to you and are therefore not personal data.

The scores are stored with Supabase Pte. Ltd, Singapore, as our processor, in a data centre in Ireland (AWS region eu-west-1). When your browser sends the scores, the provider’s infrastructure processes your IP address for operation and security; it is not stored with the scores.

8. Client Area of Our AI Answer Measurement Tool (Beta)

Our tool for measuring how accurately AI systems describe companies and products is available only to clients with a login and two-factor authentication. It has its own privacy policy, shown in the application. In short:

• Account data: email address, password (stored only as a hash), two-factor secret, organisation and role, and the times of logins, invitations and password resets.
• Audit trail: who made which change and when, for example confirming a fact or starting a check.
• Content: public information about brands and products (web pages, documents, questions, AI answers and their assessment). This content usually contains no personal data, but may contain names where a source mentions them.
• Technical data: IP address, time, page and browser data in the logs of our hosting providers.

The application runs on Vercel (servers in Frankfurt, Germany; Vercel Inc., USA). Database, login and system emails run on Supabase (Frankfurt, Germany). Automated checks run on GitHub (USA). To measure, questions and source texts, but no account data, are sent to the AI systems of Anthropic (USA) and Google (Gemini API, USA). We use these AI services under paid commercial terms, under which inputs are not used to train their models.

The tool is meant for public information. Clients must not enter personal data of third parties, unpublished product data or confidential information. Client data is kept for the duration of the contract; after it ends we delete it unless the client asks for an export first or the law requires longer retention.

9. Recipients

Personal data is disclosed only to the processors named in this policy, who act on our instructions and under a data processing agreement, and to authorities where the law requires it. We do not pass personal data to other third parties.

10. Transfers Abroad

Some processors are located, or may access data, outside Switzerland. For transfers to countries without adequate data protection under Swiss law, we rely on the safeguards stated below.

11. Retention

We keep personal data only as long as the purpose requires; the periods are stated in the sections above. Records of mandates, contracts and invoices are kept for ten years as required by Swiss commercial and tax law (Art. 958f Code of Obligations).

12. Security

We use appropriate technical and organisational measures, including encrypted connections, access restricted to the persons who need it, and two-factor authentication for the client area. No system is completely secure; we will inform you and the authorities where the law requires it.

13. Your Rights

Under the FADP and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate data;
• Erasure of data we are not required to keep;
• Object to processing, and, under the GDPR, request restriction;
• Receive or transfer data you provided, in a common electronic format (Art. 28 FADP, Art. 20 GDPR);
• Withdraw consent at any time, with effect for the future.

Exercising these rights is free of charge as a rule. We may ask you to verify your identity. We do not make automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR.

Write to kevin.lancashire@lancashire-digital.ch. You may also complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, and, if the GDPR applies, to the supervisory authority in your EU country.

14. Changes

We update this policy when our processing or the law changes. The version published here applies, with the date shown at the top.